Weakness of Codeigniter Input Library

Codeigniter Input Library has minimized many security holes. But still there are some leaks in it. The input library has defined some html keywords as naughty entries. But these naughty keywords are not all to be aware of.

There are still many keywords which have significant threat for a website. So, we must need to take care of those malwords. Let's discuss some of them.

the header tags 'h1', h2, h3, h4, h5, h6 can have a significant impact, if we use it with the input library. if we use only the starting tag and never end those tags, then our page layout will be broken. Use the following with h1 tag at the beginning and you will see the result in the browser.

it is a long established fact that a reader will be distracted by the readable content of a page when looking at its layout. The point of using Lorem Ipsum is that it has a more-or-less normal distribution of letters, as opposed to using 'Content here, content here', making it look like readable English. Many desktop publishing packages and web page editors now use Lorem Ipsum as their default model text, and a search for 'lorem ipsum' will uncover many web sites still in their infancy. Various versions have evolved over the ye

Again if we use b, strong keywords the same will be the case.

See how to solve it here.
See the book OpenCart 1.4 Template Design Cookbook.
See the book Joomla Mobile Development Beginners Guide

List of my works:

Technical Support:

If you still face the technical problem, please get support of our highly skilled technical team: garazlab.com.


Wordpress Plugins:

1. Real-Time Health Data from Every Where:WP plugin to display real-time health data & increase sale by promoting user specific products according to health information: garazlab.com.
2. Woocommerce Stock Notification Builder:Sends desktop, mobile & email notifications with full customization.Build your own product notification system with it: garazlab.com.

Opencart Extensions:

1. Product Based Quantity Wise Shipping: Find it here.
2. OpenSSLCOMMERZ: integrate SSLCOMMERZ with opencart: Find it here.
3. Fine Search v.1.0 - Improves Opencart search feature to find relevant: Find it here.
4. Opensweetcaptcha - An easy way to generate attractive captcha for your system!: Find it here.
5. Custom Field Product - add unlimited custom fields to the product form: Find it here.
6. Formcaptcha - add captcha on the register page: Find it here.

My Books:

1. OpenCart 1.4 Template Design Cookbook.
2. Joomla Mobile Development Beginners Guide

handling cross-site request forgery

csrf exploits the trust of application on user. csrf attacks are best way to handle by sending a form with post method. There can be a way to prevent csrf with adding a secret token in form hidden field.


Question : What is the best measure one can take to prevent a cross-site request forgery?

Answer:

1. Disallow requests from outside hosts
2. Add a secret token to all form submissions
3. Turn off allow_url_fopen in php.ini
4. Filter all output
5. Filter all input
See the book OpenCart 1.4 Template Design Cookbook.
See the book Joomla Mobile Development Beginners Guide

List of my works:

Technical Support:

If you still face the technical problem, please get support of our highly skilled technical team: garazlab.com.


Wordpress Plugins:

1. Real-Time Health Data from Every Where:WP plugin to display real-time health data & increase sale by promoting user specific products according to health information: garazlab.com.
2. Woocommerce Stock Notification Builder:Sends desktop, mobile & email notifications with full customization.Build your own product notification system with it: garazlab.com.

Opencart Extensions:

1. Product Based Quantity Wise Shipping: Find it here.
2. OpenSSLCOMMERZ: integrate SSLCOMMERZ with opencart: Find it here.
3. Fine Search v.1.0 - Improves Opencart search feature to find relevant: Find it here.
4. Opensweetcaptcha - An easy way to generate attractive captcha for your system!: Find it here.
5. Custom Field Product - add unlimited custom fields to the product form: Find it here.
6. Formcaptcha - add captcha on the register page: Find it here.

My Books:

1. OpenCart 1.4 Template Design Cookbook.
2. Joomla Mobile Development Beginners Guide

file access in php security.

In php we have doc_root,user_dir and open_basedir option to control file access using php.If we Specify the doc_root,then every request for opening a file will be checked against the doc_root.If it is not under the doc_root, the request is discarded.Another one is user_dir. user_dir is used with respect to doc_root.If a user_dir is specified then a request is checked whether the file is in the doc_root and then is it in the user_dir. open_basedir controls which files will be opened using php. we must use a trailing slash after the file name to be more secure.
See the book OpenCart 1.4 Template Design Cookbook.
See the book Joomla Mobile Development Beginners Guide

List of my works:

Technical Support:

If you still face the technical problem, please get support of our highly skilled technical team: garazlab.com.


Wordpress Plugins:

1. Real-Time Health Data from Every Where:WP plugin to display real-time health data & increase sale by promoting user specific products according to health information: garazlab.com.
2. Woocommerce Stock Notification Builder:Sends desktop, mobile & email notifications with full customization.Build your own product notification system with it: garazlab.com.

Opencart Extensions:

1. Product Based Quantity Wise Shipping: Find it here.
2. OpenSSLCOMMERZ: integrate SSLCOMMERZ with opencart: Find it here.
3. Fine Search v.1.0 - Improves Opencart search feature to find relevant: Find it here.
4. Opensweetcaptcha - An easy way to generate attractive captcha for your system!: Find it here.
5. Custom Field Product - add unlimited custom fields to the product form: Find it here.
6. Formcaptcha - add captcha on the register page: Find it here.

My Books:

1. OpenCart 1.4 Template Design Cookbook.
2. Joomla Mobile Development Beginners Guide

displaying errors in a site.

Error message shows mainly database related error messages. Lets see the mock zend php certification question.

Question: Why is it important from a security perspective to never display PHP error messages directly to the end user, yet always log them?

Answer:(choose 2)

1. Error messages will contain sensitive session information
session information are not shown in a error message.
2. Error messages can contain cross site scripting attacks
xss attack is not possible with such error message.
3. Security risks involved in logging are handled by PHP
4. Error messages give the perception of insecurity to the user
5. Error messages can contain data useful to a potential attacker
See the book OpenCart 1.4 Template Design Cookbook.
See the book Joomla Mobile Development Beginners Guide

List of my works:

Technical Support:

If you still face the technical problem, please get support of our highly skilled technical team: garazlab.com.


Wordpress Plugins:

1. Real-Time Health Data from Every Where:WP plugin to display real-time health data & increase sale by promoting user specific products according to health information: garazlab.com.
2. Woocommerce Stock Notification Builder:Sends desktop, mobile & email notifications with full customization.Build your own product notification system with it: garazlab.com.

Opencart Extensions:

1. Product Based Quantity Wise Shipping: Find it here.
2. OpenSSLCOMMERZ: integrate SSLCOMMERZ with opencart: Find it here.
3. Fine Search v.1.0 - Improves Opencart search feature to find relevant: Find it here.
4. Opensweetcaptcha - An easy way to generate attractive captcha for your system!: Find it here.
5. Custom Field Product - add unlimited custom fields to the product form: Find it here.
6. Formcaptcha - add captcha on the register page: Find it here.

My Books:

1. OpenCart 1.4 Template Design Cookbook.
2. Joomla Mobile Development Beginners Guide